chore(deps-dev): bump oauth4webapi from 2.17.0 to 3.1.1

[dependabot]

Bumps oauth4webapi from 2.17.0 to 3.1.1.

Release notes

Sourced from oauth4webapi's releases.

v3.1.1

Refactor

• simpler consume of Request bodies (bcf0b86)

v3.1.0

Features

• add support for form_post Request instance in hybrid response mode validate response functions (5e22d9d)

v3.0.1

Refactor

• gracefully handle non-number expires_in (c7cc858), closes #47 #71 #77 #112
• update assertCryptoKey error message (999a373)

v3.0.0

⚠ BREAKING CHANGES

• build target is now ES2022
• jweDecrypt is no longer an allowed symbol on the Client interface, it is instead an option passed to functions that may encounter encrypted assertions
• specifying Ed448 curve for EdDSA is no longer supported, EdDSA is now just an alias for the fully-specified Ed25519 JWS algorithm
• assertions signed with an Ed25519 CryptoKey will now use the Ed25519 JWS alg value instead of EdDSA. This can be reverted using the modifyAssertion symbol export
• the audience of a Private Key JWT and Client Secret JWT client assertions is now just the issuer identifier
• remove modifyAssertion from the PrivateKey interface
• optional (non-repudiation) signature validation of ID Token JWS Signatures is now done the same way as JWT UserInfo and JWT Introspection is done, with a Response instance rather than a TokenEndpointResponse object
• validateJwtIntrospectionSignature is now validateApplicationLevelSignature
• validateJwtUserInfoSignature is now validateApplicationLevelSignature
• validateIdTokenSignature is now validateApplicationLevelSignature
• DPoP request options are now obtained by calling the DPoP() exported function. This returns a handle that also maintains its own LRU nonce caches
• client authentication is now an explicit argument to authenticated functions
• processAuthorizationCodeOpenIDResponse() method was removed in favour of processAuthorizationCodeResponse()
• processAuthorizationCodeOAuth2Response() method was removed in favour of processAuthorizationCodeResponse()
• All grant functions that execute against the Token Endpoint will now validate ID Token when there is one in the response. This has already been the behaviour of functions such as processRefreshTokenResponse() or processDeviceCodeResponse()
• Presence of auth_time is now required in all ID Tokens if client.default_auth_time is set
• encode client_secret_basic - _ . ! ~ * ' ( ) characters
• remove all deprecated options
• remove the useMtlsAlias symbol and options
• all functions now reject interacting with non-TLS HTTP endpoints. You can use the allowInsecureRequests in the HttpRequestOptions interface to revert this behaviour.
• removed the isOAuth2Error() helper, all functions that used to possibly return an OAuth2Error now reject with ResponseBodyError or AuthorizationResponseError instead
• removed parseWwwAuthenticateChallenges(), all functions verify process Response now reject with WWWAuthenticateChallengeError instead
• removed protectedResourceRequest() now rejects with WWWAuthenticateChallengeError when the Response has one

Features

• add a counterpart process method to genericTokenEndpointRequest (848f3f6)
• add a helper function for DPoP retry management (06493e3)
• add support for client_secret_jwt (cf85fd6)
• add support for code id_token response without FAPI 1.0 s_hash (eebb4f1)
• add unified authorization code method (07d4ff9)

... (truncated)

Changelog

Sourced from oauth4webapi's changelog.

3.1.1 (2024-10-14)

Refactor

• simpler consume of Request bodies (bcf0b86)

3.1.0 (2024-10-14)

Features

• add support for form_post Request instance in hybrid response mode validate response functions (5e22d9d)

3.0.1 (2024-10-13)

Refactor

• gracefully handle non-number expires_in (c7cc858), closes #47 #71 #77 #112
• update assertCryptoKey error message (999a373)

3.0.0 (2024-10-07)

⚠ BREAKING CHANGES

• build target is now ES2022
• jweDecrypt is no longer an allowed symbol on the Client interface, it is instead an option passed to functions that may encounter encrypted assertions
• specifying Ed448 curve for EdDSA is no longer supported, EdDSA is now just an alias for the fully-specified Ed25519 JWS algorithm
• assertions signed with an Ed25519 CryptoKey will now use the Ed25519 JWS alg value instead of EdDSA. This can be reverted using the modifyAssertion symbol export
• the audience of a Private Key JWT and Client Secret JWT client assertions is now just the issuer identifier
• remove modifyAssertion from the PrivateKey interface
• optional (non-repudiation) signature validation of ID Token JWS Signatures is now done the same way as JWT UserInfo and JWT Introspection is done, with a Response instance rather than a TokenEndpointResponse object
• validateJwtIntrospectionSignature is now validateApplicationLevelSignature
• validateJwtUserInfoSignature is now validateApplicationLevelSignature
• validateIdTokenSignature is now validateApplicationLevelSignature
• DPoP request options are now obtained by calling the DPoP() exported function. This returns a handle that also maintains its own LRU nonce caches

... (truncated)

Commits

• 9714df6 chore(release): 3.1.1
• bcf0b86 refactor: simpler consume of Request bodies
• 100bd64 chore: cleanup after release
• 7abb73b chore(release): 3.1.0
• 5e22d9d feat: add support for form_post Request instance in hybrid response mode vali...
• 0ed4719 chore: cleanup after release
• 6327c97 chore(release): 3.0.1
• c7cc858 refactor: gracefully handle non-number expires_in
• 999a373 refactor: update assertCryptoKey error message
• a21fd32 chore: update README.md
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #18.